CVE-2026-0257highunder attackransomwareCWE-565

CVE-2026-0257: high-severity vulnerability in Palo Alto Networks PAN-OS

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Published · Updated

Follow this CVE+ Monitor PAN-OS+ Monitor Prisma Access

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 96%
from disclosure to weapon16 days
Published on NVDMay 13
1st PoC+16d
CISA KEV+16d
victimsOct 22
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Appeared in 1 incident(s) we investigated
Palo Alto Networks PAN-OS GlobalProtect (CVE-2026-0257)
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwareqilin Vexday
Action required by CISAfederal deadline: 2026-06-01

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Palo Alto Networks PAN-OS has a flaw in its GlobalProtect VPN system that allows attackers to bypass login requirements and connect to the network without proper authentication. This is dangerous because it gives unauthorized access to corporate resources.

Technical detail

Authentication bypass vulnerability in PAN-OS GlobalProtect portal and gateway (CWE-565) allows unauthenticated attackers to establish unauthorized VPN connections by circumventing security restrictions. The attack requires network access to the GlobalProtect interface but no valid credentials; successful exploitation grants unauthorized access to protected network resources. Panorama and Cloud NGFW deployments are not affected.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red
Affected products
Palo Alto Networks · Cloud NGFWPalo Alto Networks · PAN-OSPalo Alto Networks · Prisma Access
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Palo Alto Networks PAN-OS

In the same product, most dangerous first.

CVE-2024-3400CRITICALPAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectEPSS 100.0%KEVCVE-2024-0012CRITICALPAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)EPSS 99.8%KEVCVE-2025-0108HIGHPAN-OS: Authentication Bypass in the Management Web InterfaceEPSS 98.5%KEVCVE-2024-9474MEDIUMPAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management InterfaceEPSS 93.8%KEVCVE-2026-0300CRITICALPAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication PortalEPSS 41.7%KEVCVE-2024-3393HIGHPAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted PacketEPSS 29.1%KEV